What is Application Orangelisting?
Application orangelisting takes action on applications that you have not explicitly trusted in your environment in an attempt to mitigate exposure to malware. Orangelisting is a method that allows potentially trusted applications to run securely in your environment.
Orangelisting is a dynamic method of managing applications that are might not be included on the a whitelist or the blacklist. Orangelisting allows potentially trusted applications to run securely.
Arellia's Application Control Solution allows you to manage applications flexibly in a large, distributed client environment by putting:
- known trusted applications in a whitelist
- potentially trusted applications in an orangelist (also known as a graylist)
- everything else in a blacklist
...
Instead of putting an unknown application into an automatic blacklist, you can apply a flexible policy that includes one or more actions such as running with demoted privileges, running read-only, notifying end users of corporate policy or running in a virtual layer. You can place applications that are potentially trusted in an orangelist and in some cases this can be the only other policy. By limiting an application’s impact to the operating system and other software, end users can use a piece of software and allow IT to review the software for black or white listing at a later date. At that later date a piece of software could be permanently allowed, denied for risk or legal reasons, or moved to a permanent orangelist.
Orangelist: Potentially trusted applications need to run, but with fewer rights.
Orangelisting by Trusted Location
Most software environments are dynamic resulting in situations that are not necessarily black and white. Many whitelisting solutions automatically blacklist any software that isn’t in a whitelist. While this is achievable with Application Control Solution, Arellia’s experience has found that this approach results in denials of service and angry users. To protect against a changing environment, the concept of Orangelisting (also known as graylisting) should be used for applications that are potentially trusted, but not in a whitelist.
In the case of Orangelists, they should target trusted software on a dimension different than the whitelist. One approach could be to trust software from certain vendors, certain digital signatures, or certain locations.
...
.
...
Orangelisting actions:
...